Executive brief
pymetasploit3 is a Python library used to automate the Metasploit penetration testing framework. A vulnerability in how the library handles module options allows an attacker to inject malicious commands into the Metasploit console. This could lead to unauthorized control over security testing sessions, data exposure, or arbitrary command execution on the system running the automation.
Technical details
A command injection vulnerability exists in the console.run_module_with_output() function of pymetasploit3 through version 1.0.6. The root cause is improper neutralization of newline characters in module options such as RHOSTS. An attacker can provide input containing these characters to break the intended command structure, forcing the Metasploit console to execute additional, unintended commands. This can be exploited remotely without authentication if the application using the library passes untrusted input to the affected function. As of the advisory date, no patched version has been released.
Affected products
- DanMcInerney pymetasploit3 <= 1.0.6
Timeline
- 2026-04-03: disclosed
- 2026-04-03: advisory: GHSA-qpc3-8vqg-8g6w published